Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden – Open Source Password Manager

bitwarden.com

Post reply on HN
Print view View original

121–130 of 163 posts

Re: Bitwarden – Open Source Password Manager

#121

Post by chme »

phaer wrote: post #117
chme wrote: post #115

Earlier quoted context omitted.

I like and use pass regulary, but it has some inconveniences. - It doesn't encrypt the paths to the passwords - It doesn't use a structural language for the password files, so additional information like username has to be stored in the path of the password - It doesn't work with (Update: X.509) smartcards/gpgsm - It's written in bash. That has pros and cons...

> - It doesn't use a structural language for the password files, so additional information like username has to be stored in the path of the password only the first line of an encrypted file is considered to be the password. So you can just but your username or any other account-related information on the following lines. > - It doesn't encrypt the paths to the passwords To elaborate: One of the problems with this ap…

>> - It doesn't use a structural language for the password files, so additional information like username has to be stored in the path of the password

> only the first line of an encrypted file is considered to be the password. So you can just but your username or any other account-related information on the following lines.

I didn't know that. But what I would have preferred was copying the username with one command and copying the password with another.

>> - It doesn't work with smartcards/gpgsm

> What do you mean by that? I use pass with my yubikey as a gpg "smartcard"?

I haven't tried that with a yubi key, but with a corporate X.509 id card. And that needed gpgsm. I had to patch pass in order for it to work, because gpgsm uses different parameters that gpg.

Re: Bitwarden – Open Source Password Manager

#122

Post by muhblah »

pmontra wrote: post #102
muhblah wrote: post #92

Earlier quoted context omitted.

> Open source but we have to pay licenses for the database if we want to self host. As Bitwarden states in the core readme ( https://github.com/bitwarden/core#requirements ) "These dependencies are free to use." And if you lookup the licensing on MSFTs website ( https://www.microsoft.com/en-us/sql-server/sql-server-2017-p... ) you can see that the SQL Server Express version is free. Note: No, I'm not an MSFT employee…

I'm not in the Microsoft stack so I have no idea how much SQL Server and SQL Server Express are compatible. I only know they exist. The README requires SQL Server so I might be excused thinking that it would work only with that software. Nice to know that it does work on the free version too. I googled and looked on MS site and didn't find out if SQL Server Express exists for Linux too, but I'm on my phone right now.…

> I googled and looked on MS site and didn't find out if SQL Server Express exists for Linux too, but I'm on my phone right now.

There you go: https://hub.docker.com/r/microsoft/mssql-server-linux/

:)

Re: Bitwarden – Open Source Password Manager

#123

Post by graedus »

vasili111 wrote: post #116
hottycat3 wrote: post #83

Earlier quoted context omitted.

Keepass2 is also Open-Source and .Net because as far as I know .Net offers some extra security on Windows like locking the desktop while entering the master password.

Can you please give me a link about locking desktop while entering a master password in KeePass? I want to know more about it.

https://keepass.info/help/kb/sec_desk.html

Re: Bitwarden – Open Source Password Manager

#124

Post by LyndsySimon »

giggsey wrote: post #86
ohthehugemanate wrote: post #77

I switched from LastPass to bitwarden in November, and I love it. - it's FOSS, and audited, so it's software I can trust - great UX on Firefox, chrome, and even Edge. I had my issues, but the project improved them away very quickly. - sharing support for families or organizations. - convenient standalone clients for win/Mac/Linux... And even the CLI. - built in 2FA code generation for each entry, so I don't need a se…

Is storing the 2FA codes alongside your password a wise idea?

It depends on the use case, but generally speaking, yeah.

It's less secure than a dedicated device for storage of the 2FA secrets and code generation, sure, but I don't see how it's any less secure than using a service like Duo to manage and sync your secrets.

Furthermore, I'd argue it's substantially more secure than the recovery process for almost all of the services I use, most of which offer an option to reset by SMS.

Finally, keeping your 2FA secrets in your password manager is very likely not to change the attack surface for most people anyhow, as most people keep their recovery codes in their password managers as well.

Re: Bitwarden – Open Source Password Manager

#125

Post by seveneightn9ne »

bogle wrote: post #101
tobiaswk wrote: post #67

Earlier quoted context omitted.

Great tool. I use it together with keybase.

How are you using it with Keybase.io?

You can use keybase git as the backing storage for pass: https://keybase.io/blog/encrypted-git-for-everyone

Re: Bitwarden – Open Source Password Manager

#126

Post by LyndsySimon »

keehun wrote: post #35
philliphaydon wrote: post #29

Earlier quoted context omitted.

> I still felt its sluggish performance on launch/search/sync was slowing me down a lot throughout the day. I recently switched (maybe 5 weeks or so, ago, from 1Password to Bitwarden, after finding out about it on HN) I imported ~400 odd logins from 1Password, I honestly don't find it any slower than 1 Password. I did notice that with Discord, both 1Password and Bitwarden now integrate with the new iOS password apis.

Maybe it's just my phone (6) but you may find that once you get 1000+ logins, Bitwarden falls apart pretty quickly. I've heard the same from people with 800+ logins. I remember it used to be very quick when I initially used it with a few plugins. IIRC from their Github issue threads, Bitwarden is using Xamarin, and performant UI has been a consistent struggle with many login entries.

Bitwarden has had some performance issues in the past with managing larger (>~250) logins, but they've been greatly improved in the last few months and I no longer have an issue. My password database currently contains 870 logins.

Bitwarden's support via IRC/gitter was exceptional when I was experiencing issues with it. Not only did they fix the problem, but they provided a custom build for me with more verbose logging enabled and worked with me directly to figure out what the issue was. It was fixed in a couple of hours and I was able to run the patched build without issue until the fix had been merged and released.

Re: Bitwarden – Open Source Password Manager

#127

Post by LyndsySimon »

keehun wrote: post #100
brazzledazzle wrote: post #69

Earlier quoted context omitted.

Someone else pointed it out but it’s worth repeating that the convenience of having your 2FA on your laptop/desktop might be making a significant security trade off. It’s not really 2FA if it’s on the same device.

That’s true. I had lost sight of that... well, I wish more places would support a Yubikey!

Bitwarden itself allows you to require a Yubikey for each credential retrieval. I'm not sure how that would differ from having the Yubikey itself be the credential, from an attack surface standpoint.

Re: Bitwarden – Open Source Password Manager

#128

Post by nickjj »

chme wrote: post #115
nickjj wrote: post #112

If anyone wants an open source command line driven password manager that doesn't require signing up or hosting anything, I recommend checking out "Pass". It piggy backs off GPG encryption. https://www.passwordstore.org/ I use it to manage over 300 passwords and other sensitive blobs of text (it lets you save arbitrary text snippets) and also has some nifty quality of life features like auto-copying a password to your…

I like and use pass regulary, but it has some inconveniences. - It doesn't encrypt the paths to the passwords - It doesn't use a structural language for the password files, so additional information like username has to be stored in the path of the password - It doesn't work with (Update: X.509) smartcards/gpgsm - It's written in bash. That has pros and cons...

> - It doesn't use a structural language for the password files, so additional information like username has to be stored in the path of the password

You can use multi-line passwords with the -m flag without leaking any information in the path.

You can put whatever you want in the password entry, in whatever text format you want.

So you can save an entry like this:

areallygoodstrongpassword

Username: someusername

Secret API key: abc123

It's also really smart about what happens when you copy that entry to your clipboard. It will copy just the first line for easy password pasting.

There's a demo of me using it to store AWS credentials in this write up: https://nickjanetakis.com/blog/managing-your-passwords-on-th...

> - It doesn't encrypt the paths to the passwords

Yep, but the upside is you have tab complete in your terminal for accessing your passwords.

If you planned to put it up on github you could always encrypt the folder / file names using https://github.com/cryptomator/cryptomator or a comparable tool. I don't publish my pass fields on my public github account, so I never ran into this problem.

Re: Bitwarden – Open Source Password Manager

#129

Post by unethical_ban »

DavideNL wrote: post #65
slenk wrote: post #31

Earlier quoted context omitted.

I run my own server; it works great and is incredibly easy to set up. I would highly recommend people check this software out. It's maybe not as feature rich as other password managers, but it is being actively developed and the few times I had questions I got a quick response from Kyle (the creator).

> I run my own server If you think it matters where the data is stored (which shouldn't matter because it should be client side encrypted), running your own server would also be a risk. Because you cannot possibly have the same resources to monitor your server/router for suspicious activity...

Maybe I do, maybe I don't want my passwords to be at the same target as others, maybe I don't trust the hosting provider or Bitwarden the company (which you could argue, then I shouldn't trust the software, but I can monitor its behavior).

Re: Bitwarden – Open Source Password Manager

#130

Post by unethical_ban »

ReverseCold wrote: post #17
albertop wrote: post #15

First paragraph on their page disqualifies it completely. I do not want my passwords on anybody’s servers. Our secure cloud syncing features allow you to access your data from anywhere, on any device! Your vault is conveniently optimized for use on desktop, laptop, tablet, and phone devices.

> I do not want my passwords on anybody’s servers. What about your own server? https://help.bitwarden.com/article/install-on-premise/

I had considered setting it up until I saw that SQL Server won't start unless the container has 2G of RAM. That quadruples the price of a VM on hosting providers from the usual minimum.

What is essentially a small CRUD app with encryption requirements shouldn't need 2G just for a database app.

Post reply on HN